Hydra Brute-Force Tutorial 2026: The Complete Login-Cracking Guide

Credential Auditing

Prove that a service still accepts weak or default passwords before an attacker does. The core justification for the tool on an authorised engagement.

Password Spraying

One or two common passwords against a large user list — the lockout-safe inversion of brute force that mirrors real intrusion tradecraft.

Control Validation

Confirm that account lockout, rate limiting and alerting actually fire. If your SOC does not see the run, that is the finding.

Web App Testing

Custom HTTP POST-form attacks against bespoke login pages that scanners rarely handle well.

Two lists do 90% of the work: a small username list you build for the target, and a large password list like rockyou. Unpack rockyou and install SecLists for its curated defaults and spray lists.

Metasploitable 2 is the classic punching bag: it exposes SSH, FTP, Telnet, MySQL and PostgreSQL with weak creds by design. Import it, note its IP, and confirm you can reach the services from your attacker box.

Refresh the index and pull in Hydra. The package includes both the CLI (hydra) and the optional GTK GUI (xhydra).

Confirm the version and, crucially, which service modules were compiled in. If a protocol you need is missing from this list, that is your cue to build from source (Method 2).

These packages give you the compiler plus the optional libraries that unlock the SSH, SSL, database, SMB and other modules. Skipping a dev library simply drops that module from the build — install the lot.

Clone the repo, run the bundled configure script (it prints exactly which modules it enabled), then compile. Read the configure summary — it tells you whether ssh, mysql and rdp support made it in.

Install into /usr/local and confirm the freshly built binary is the one on your PATH rather than an older packaged copy.

A slim image built on Kali's rolling repo, with your wordlists and loot directory bind-mounted from the host so results survive teardown. No privileged, no host networking — Hydra just needs to reach the target IP.

Build the image once, then invoke Hydra through Compose. Because the ENTRYPOINT is already hydra, you pass only the arguments. Everything after the service name is handed straight to the binary.

Hydra accepts the target either as a URL (ssh://host) or as a trailing host protocol pair. Both are equivalent; the URL form is cleaner and is what the rest of this guide uses.

Point Hydra at the lab's SSH service with a single known user and a small list. The -V flag prints each pair as it goes so you can watch the mechanics; drop it once you trust the run.

To spray one password across many users while staying under lockout, loop users inside each password with -u, and add -e nsr to also test the empty password, the username-as-password, and the reversed username — three of the most common weak choices.

Legacy clear-text protocols with no throttling — Hydra runs fast against them. Telnet is quirky: it needs the failure prompt string, which the module usually auto-detects, but you can pin it if results look wrong.

RDP is a high-value target on internal networks. Keep -t low: Windows lockout policy and the RDP stack both punish parallelism, and aggressive runs lock out real users — a fast way to fail an engagement.

The smb module tests Windows/Samba logins and reports useful status such as whether an account is disabled or the password expired. Use single-task ordering to respect lockout.

Exposed database ports are a goldmine — a valid DB login often means data access and sometimes code execution. All three speak the same Hydra grammar; only the protocol keyword changes.

VNC frequently uses only a password (no username), so drop the login flag entirely. SNMP community strings are effectively passwords for network gear — public and private still work on shocking numbers of devices.

Feed a file of targets with -M to sweep a subnet for one weak credential. Combine with -F to stop globally on the first success when you only need a foothold.

First learn exactly what the browser sends. Open the login page in Firefox, submit a bogus login with DevTools' Network tab open (or Burp intercept on), and read off the request path, the POST body parameter names, and the message shown on failure.

The module option is one string of three fields separated by colons: the request path, the POST body with ^USER^ and ^PASS^ placeholders, and a condition string. Prefix the condition with F= for a failure marker or S= for a success marker.

Assemble the full command. Note the module keyword http-post-form and that the whole three-field string is a single quoted argument passed after the host.

Many forms require a session cookie and reject requests without it. Append H= (extra header) and C= (cookie fetch path) options as additional colon fields. Per-request anti-CSRF tokens defeat Hydra outright — that is a job for a scripted tool, not Hydra.

When no wordlist fits — for example a known numeric PIN policy — generate candidates on the fly with -x MIN:MAX:CHARSET. Use this sparingly; the keyspace explodes fast and online brute force is slow.

Use -C for a file of known user:pass pairs (for example leaked credentials you are checking for reuse). If a long run is interrupted, Hydra writes hydra.restore — resume exactly where it stopped with -R.

A spike of Event ID 4625 (failed logon) from one source IP across many accounts in a five-minute window is the classic spray signature. The KQL runs in Microsoft Sentinel / Defender; the SPL is the Splunk equivalent over the same Windows logs.

On Linux, failed SSH logins land in auth.log / secure as "Failed password" lines. Extract the source IP and alert on volume per source. Again, KQL first, SPL second, over the same syslog stream.

Detection tells you it happened; these controls stop it working. Layer them — no single control is sufficient, but together they make online brute force pointless.

• 1MFA everywhere. A correct password alone gets the attacker nowhere. This is the single highest-value control against every attack in this guide.
• 2Account lockout / throttling. Lock or exponentially delay after a small number of failures. On Linux, fail2ban bans the source IP after N failed SSH attempts.
• 3Key-based SSH auth. Set PasswordAuthentication no in sshd_config — Hydra has nothing to guess against a key.
• 4Rate limiting & WAF. Cap login attempts per IP per minute on web forms; a WAF rule on repeated POSTs to /login blunts http-post-form.
• 5Do not expose management ports. Put RDP, SSH, SMB and databases behind a VPN or bastion. An unreachable service cannot be brute-forced.